AIKIDO-2026-730721
@openai/codex is vulnerable to Improper Neutralization of Escape
88
High Risk
This Affects:
@openai/codexTL;DR
Codex lowers PowerShell commands to argv-like words in its command-safety parser and misinterprets the stop-parsing token (--%) differently than PowerShell itself. Because of this, certain file-writing Git commands are classified as safe and run without asking for approval when a user opens an attacker-prepared repository and follows its instructions. This can be abused to modify Codex configuration and launch an attacker-controlled MCP server, leading to code execution with the user's privileges. The fix treats PowerShell stop-parsing forms as unsupported so they stay on the approval-required path.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run Codex on Windows, or on macOS or Linux with PowerShell Core installed.
Background info
@openai/codex is vulnerable to Improper Neutralization of Escape in versions 0.1.4160940 - 0.130.0.
How to fix this
Upgrade the @openai/codex library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.